openclaw/CHFS-NG
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: preserve section rule priority

Browse Source
This commit is contained in:
OpenClaw Agent
2026-09-22 00:01:29 +08:00
parent 12fc644c50
commit 05857b91a4
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chfs-ng/internal/auth/auth.go
+1 -1
View File
@@ -112,7 +112,7 @@ func (a *Account) maskFor(path string, entry bool) PermMask {
if entry && r.ChildrenOnly && matchPathExact(d, path) { if entry && r.ChildrenOnly && matchPathExact(d, path) {
continue continue
} }
if len(d) > best { if len(d) >= best {
best = len(d) best = len(d)
if r.Deny { if r.Deny {
mask = None mask = None
chfs-ng/internal/auth/auth_test.go
+12
View File
@@ -91,6 +91,18 @@ func TestSectionRuleSemantics(t *testing.T) {
} }
} }
func TestSectionRuleSamePathPriority(t *testing.T) {
a := &Account{Mask: Delete, Rules: []PathRule{
{Dir: "secret", Mask: None, Deny: true},
{Dir: "secret", Mask: ParseMask("r"), ChildrenOnly: true},
{Dir: "secret", Mask: ParseMask("w"), ChildrenOnly: true},
{Dir: "secret", Mask: ParseMask("d"), ChildrenOnly: true},
}}
if got := a.MaskFor("secret/file"); got != ParseMask("d") {
t.Fatalf("same-path rule priority=%v", got)
}
}
func TestWildcardSectionRules(t *testing.T) { func TestWildcardSectionRules(t *testing.T) {
a := &Account{Mask: Read, Rules: []PathRule{{Dir: "project-*", Mask: Write, ChildrenOnly: true}}} a := &Account{Mask: Read, Rules: []PathRule{{Dir: "project-*", Mask: Write, ChildrenOnly: true}}}
if got := a.MaskFor("project-one/file"); got != Write { if got := a.MaskFor("project-one/file"); got != Write {